U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

CVE-2024-26664 Detail

Description

In the Linux kernel, the following vulnerability has been resolved: hwmon: (coretemp) Fix out-of-bounds memory access Fix a bug that pdata->cpu_map[] is set before out-of-bounds check. The problem might be triggered on systems with more than 128 cores per package.


Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 3.x Severity and Vector Strings:

NIST CVSS score
NIST: NVD
Base Score:  7.1 HIGH
Vector:  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to nvd@nist.gov.

Hyperlink Resource
https://git.kernel.org/stable/c/1eb74c00c9c3b13cb65e508c5d5a2f11afb96b8b Patch 
https://git.kernel.org/stable/c/1eb74c00c9c3b13cb65e508c5d5a2f11afb96b8b Patch 
https://git.kernel.org/stable/c/3a7753bda55985dc26fae17795cb10d825453ad1 Patch 
https://git.kernel.org/stable/c/3a7753bda55985dc26fae17795cb10d825453ad1 Patch 
https://git.kernel.org/stable/c/4e440abc894585a34c2904a32cd54af1742311b3 Patch 
https://git.kernel.org/stable/c/4e440abc894585a34c2904a32cd54af1742311b3 Patch 
https://git.kernel.org/stable/c/853a6503c586a71abf27e60a7f8c4fb28092976d Patch 
https://git.kernel.org/stable/c/853a6503c586a71abf27e60a7f8c4fb28092976d Patch 
https://git.kernel.org/stable/c/93f0f4e846fcb682c3ec436e3b2e30e5a3a8ee6a Patch 
https://git.kernel.org/stable/c/93f0f4e846fcb682c3ec436e3b2e30e5a3a8ee6a Patch 
https://git.kernel.org/stable/c/9bce69419271eb8b2b3ab467387cb59c99d80deb Patch 
https://git.kernel.org/stable/c/9bce69419271eb8b2b3ab467387cb59c99d80deb Patch 
https://git.kernel.org/stable/c/a16afec8e83c56b14a4a73d2e3fb8eec3a8a057e Patch 
https://git.kernel.org/stable/c/a16afec8e83c56b14a4a73d2e3fb8eec3a8a057e Patch 
https://git.kernel.org/stable/c/f0da068c75c20ffc5ba28243ff577531dc2af1fd Patch 
https://git.kernel.org/stable/c/f0da068c75c20ffc5ba28243ff577531dc2af1fd Patch 
https://lists.debian.org/debian-lts-announce/2024/06/msg00017.html Mailing List 
https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html Mailing List 

Weakness Enumeration

CWE-ID CWE Name Source
CWE-787 Out-of-bounds Write cwe source acceptance level NIST  

Known Affected Software Configurations Switch to CPE 2.2

Configuration 1 ( hide )
 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
   Show Matching CPE(s)
From (including)
4.19.264
Up to (excluding)
4.19.307
 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
   Show Matching CPE(s)
From (including)
5.4.221
Up to (excluding)
5.4.269
 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
   Show Matching CPE(s)
From (including)
5.10.152
Up to (excluding)
5.10.210
 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
   Show Matching CPE(s)
From (including)
6.1
Up to (excluding)
6.1.78
 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
   Show Matching CPE(s)
From (including)
6.2
Up to (excluding)
6.6.17
 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
   Show Matching CPE(s)
From (including)
6.7
Up to (excluding)
6.7.5
 cpe:2.3:o:linux:linux_kernel:6.8:rc1:*:*:*:*:*:*
   Show Matching CPE(s)
 cpe:2.3:o:linux:linux_kernel:6.8:rc2:*:*:*:*:*:*
   Show Matching CPE(s)
 cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*
   Show Matching CPE(s)

Configuration 2 ( hide )
 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
   Show Matching CPE(s)

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

8 change records found show changes

Quick Info

CVE Dictionary Entry:
CVE-2024-26664
NVD Published Date:
04/02/2024
NVD Last Modified:
03/17/2025
Source:
kernel.org